2017/05/02 by Arpit Gupta, Gupta, Arpit, Rob Harrison +13 · 1 citation
Computer Science · #FOS: Computer and information sciences #Network Security and Intrusion Detection #Network Traffic and Congestion Control #Networking and Internet Architecture (cs.NI) #Software-Defined Networks and 5G
paper · pdf · doi:10.48550/arxiv.1705.01049
openalex publication_date 2017/05/02 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
Operating networks depends on collecting and analyzing measurement data. Current technologies do not make it easy to do so, typically because they separate data collection (e.g., packet capture or flow monitoring) from analysis, producing either too much data to answer a general question or too little data to answer a detailed question. In this paper, we present Sonata, a network telemetry system that uses a uniform query interface to drive the joint collection and analysis of network traffic. Sonata takes the advantage of two emerging technologies---streaming analytics platforms and programmable network devices---to facilitate joint collection and analysis. Sonata allows operators to more directly express network traffic analysis tasks in terms of a high-level language. The underlying runtime partitions each query into a portion that runs on the switch and another that runs on the streaming analytics platform iteratively refines the query to efficiently capture only the traffic that pertains to the operator's query, and exploits sketches to reduce state in switches in exchange for more approximate results. Through an evaluation of a prototype implementation, we demonstrate that Sonata can support a wide range of network telemetry tasks with less state in the network, and lower data rates to streaming analytics systems, than current approaches can achieve.